Prevent stale process state after failures - #13
Merged
Conversation
Context: Managed process output could leave values such as tunnel URLs in session state after an executable disappeared. A later workflow could accept that persisted readiness and announce a URL owned by no running process, while the top-level log hid the dependency error's root cause. Decision: Treat output-derived state as a lease owned by one managed process instance. Invalidate it before every start attempt and when the process stops or exits; require a live child before and after readiness succeeds; reap exits observed during readiness through the normal supervisor policy. Preserve the existing nonfatal workflow policy, but log the complete causal chain and name degraded mode explicitly. Release the bug fix as 0.10.2. Alternatives considered: A required-process flag or unconditional runtime abort would prevent degraded operation, which is useful when unrelated workflows can still run. A config- specific cloudflared preflight would leave the stale-state bug available to every other managed dependency. Tradeoffs: Session-state persistence failures remain fatal before a new process starts, because starting without revoking old ownership is unsafe. During teardown, invalidation failures are logged and cleanup continues so descendants cannot leak and the runtime does not fail solely because an exited child could not rewrite the state file. Architectural impact: ProcessManager now owns the lifecycle of process-derived state alongside child supervision. Workflow orchestration still decides whether a failed workflow is fatal; the runtime continues in degraded mode without publishing stale process-derived values. Validation: - cargo fmt --check - cargo test - cargo clippy --all-targets --all-features -- -D warnings - release-notes-from-changelog.sh 0.10.2 pasunboneleve/devloop - Roborev job 211 findings resolved; verification job 212 findings resolved before the stalled job was canceled Kata: k8q0
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
0.10.2Validation
cargo fmt --checkcargo test(167 unit tests, 6 integration tests)cargo clippy --all-targets --all-features -- -D warnings./scripts/release-notes-from-changelog.sh 0.10.2 pasunboneleve/devloopReview
Required CI gate
This PR must not merge unless both
Linux / rustandmacOS / rustare green.Kata: k8q0